Looks like some obfuscation technique was applied to this piece of code (none of start opcodes were identified properly):

enter image description here

Is it possible to produce manually more readable assembly?

  • @Robert, the section is identified as a code (you can see on screen .text), but neither automatic nor manual reinterpretation ain't successful =(
    – AseN
    Commented Feb 4 at 19:07

1 Answer 1


It's difficult to say for sure without the sample, but I suspect that the code has been encrypted/scrambled, and is decrypted on load, most likely by some function which runs before the entrypoint (e.g. a pointer in .init_array or similar).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.